The text appears to be detailed and comprehensive. As an introduction to computer security, there were a few assumptions made about the readers. Abbreviations used throughout the text were difficult to decipher. A common practice is to write out the terms with the abbreviations used in parentheses immediately following. I did not find this in the text, requiring me to reread the chapters several times to get a feel for what is being described. This includes statistical nomenclature. Students taking an introductory course may not have had statistics and not understand the symbols presented. For symbols, an appendix should have been included which defines those labels for readers. Otherwise, I have found the examples to bring meaning to the content. It was through the examples that I was able to grasp the intent of each chapter.
This was the textbook for one of my Comp Science grad courses and I didn't really care for it. I think it put way too much emphasis on modeling and theory and none at all on practical implementation. You will not be able to secure a network after reading this book. This book will give you some information on security theory and really would only benefit designers of systems in the 70s-80s or academics, not IT practitioners.
This book has seen better days. The author appears to have cut-and-pasted hundreds of UNIX references into the book "in order to beef it up..." I assume. If you look at the references in the back of the textbook, many of them date from the mid-1980s. For example, his discussion of viruses and worms make NO reference to Code Red (or subsequent worms) but have extensive cut-and-paste data from a 1985 IEEE paper. You get the picture. Most of his other chapters are the same.
This book is as its title implies, an introduction level text on computer security. Its style and occupation of the Author indicate that it is a college level textbook on the subject. As far as giving a foundation level grounding on the subject, it covers all the usual bases and as such is worth the read. It is not a practical guide however.
It covers all the normal subjects you would expect. in good detail and depth. A lot of the examples are about UNIX or Multics. Also it has a lot (and I mean a lot) of theory and its associated math. This does make for rather heavy reading. Some chapters such as Chapter 15, Information flow require more than a little prior knowledge of programming to fully understand.
Unfortunately, I acquired this book during my study for the CISSP Certification, and although many subjects are covered, there are many more books written for the CISSP exam that cover the requirements for the exam and are better suited for that task.
In short, it is a good textbook on Computer Security. Heavy on theory and math and with a lot of examples on UNIX and Multics systems. It is not a practical guide to securing your (mostly Microsoft) Network. For those looking to pass the CISSP exam there are better study guides out there to spend your time with.
While I hail from academic background, this book was too much at times for me. The book does contain some fun and useful information on security theory, which is presented well (no mean feat!). The fans of Bell-LaPadula model and such things will find them in the book.
On the other hand, it is explicitly weak on the practical side. The book seeks to connect theory and practice, but it seems that it did not completely build the connection. Most of the practical things (such as intrusion detection, malware, etc) are much better covered elsewhere. I liked the auditing chapter, however. It does contain a harmonious mix of theory and practice, fused together. Intrusion detection chapter was weaker, and it only covered ancient IDS projects such as DIDS. If you like more formal presentation of it, get Becky Bace's book.
The author states that 'computer security is not just a science, but also an art' (preface). No kidding! It pains me to say so, but practical security nowadays seems much more like an art (and, some say, a 'black art':-)) rather than real science, like physics.
The book is most useful to students of computer security, as a textbook or supporting maters (it does have exercises in the end of each chapter). It might come handy for practitioners as well, if you are into that sort of thing :-)
Anton Chuvakin, Ph.D., GCIA, GCIH, GCFA is a Security Strategist with a major security company. He is an author of the book "Security Warrior" and a contributor to "Know Your Enemy II". In his spare time, he maintains his security portal info-secure.org
I recently finished the book Introduction to Computer Security by Matt Bishop (Addison-Wesley). I hope to be fair on this review, but I'm probably going to be a little harsh...
Chapter list: Preface; An Overview of Computer Security; Access Control Matrix; Foundational Results; Security Policies; Confidentiality Policies; Integrity Policies; Hybrid Policies; Basic Cryptography; Key Management; Cipher Techniques; Authentication; Design Principles; Representing Identity; Access Control Mechanisms; Information Flow; Confinement Problem; Introduction to Assurance; Evaluating Systems; Malicious Logic; Vulnerability Analysis; Auditing; Intrusion Detection; Network Security; System Security; User Security; Program Security; Lattices; The Extended Euclidean Algorithm; Virtual Machines; Bibliography; Index
OK, for the good stuff. This is probably one of the most complete academic treatments of computer security that I've ever seen. According to the preface, this is a "condensed" and updated version of the author's earlier work, Computer Security: Art and Science. His three goals, which are probably met, are to show the importance of theory to practice/practice to theory, to emphasize that computer security and cryptography are different, and to demonstrate that computer security is a science *and* an art. He also considers this book to omit much of the mathematical formalism. And that's where I start to have problems. In my opinion, he missed his target entirely.
Following the statement about omitting the mathematical formalism, we have this statement: "It is suited for computer security professionals, students, and prospective readers who have a less formal mathematical background, or who are not interested in the mathematical formalisms and would only be distracted by them, or for courses with a more practical than theoretical focus." Honestly, I don't know of many computer professionals holding down full-time jobs who would see this as a practical book. There is still a lot of mathematical "formalism" for a practical book, and I didn't finish reading this book thinking that there were a number of things I'll do different now in my job. If I were taking a college level course on computer security theory and structure, it'd probably work. But to give this to your coworker who is studying for a security certification as well as monitoring logs on a system would make him wonder if he did something to offend him...
If you need theory and coursework-style material, this book will give it to you. If you're looking for something that deals with hands-on security stuff you can use in your job tomorrow, I really think you'll be disappointed.
The only people who hate security systems more than the end users who have to put up with a badly designed system are those who want to break into systems that have good security.
Security for computer systems is very real and growing problem. Far beyond the virus that might come on an e-mail, white collar crime is much more expensive than other kinds. A grocery store holdup might net a few hundred dollars, a bank robbery a few thousand, the average white collar crime is in the hundreds of thousands. And the price of information may be worth life itself as in the case of the Enigma codes in World War II.
This book is balanced at at interesting level above the how to and below the highly theoretical. It has some of the theory, and some of the how to. More important, it explains the why and the how, the broad concepts that enable a manager concerned with security, or the new security manager to set up an effective system that is tailored to the risk, the company, the employees, and others who might have some access to their computer system.
I would rate this book at an intermediate level to move the reader higher up the professional scale. Highly recommended.
For those looking for a step-by-step book for securing your Windows XP box, you have come to the wrong place. This is a textbook covering security fundamentals from mathematical concepts, like cyphers and encryption, to the analysis of intrusions, viruses and worms through to policy aspects. About as concrete as it gets in terms of implementation comes in the second to last chapter on securing the internals of a C program.
This book provides an excellent grounding in the fundamentals of security. A must have for anyone studying security, or for those looking for a deeper understanding of IT security fundamentals.
Most books on computer security describe and show how to use cryptography. But often due to lack of space and audience expertise, they often do not give any detailed theory of cryptosystems. There is relatively little maths in such books. In turn, cryptography books fall into roughly two piles. One is highly mathematical and abstract; deliberately independent of any operating system or implementation. The other uses those theorems from the previous type of book, and is more tied to some software package that implements them.
Bishop's book stands differently. The level of the maths and the notation and the rigour with which he describes the cryptosystems would not be out of place in an algorithms book. But it is not all maths. There are chapters on Identity and on Access Control Mechanisms that are traditional sysadmin-type discussions. Veterans of running DEC's VMS machines will see much familiar material. But these discussions are also characterised by a level of analysis uncommonly seen in most sysadmin books. Bishop tries to show how behind such things like Access Control Lists, there is a systematic logic. Other books that might be tied to a given operating system or package might bury you in details, and obscure a general model.
If you have wanted to dig deeper into the subject and have good background in discrete maths, Bishop is worth reading.
Product Details :
Hardcover: 784 pages
Publisher: Addison-Wesley Professional; 1 edition (November 5, 2004)
Language: English
ISBN-10: 0321247442
ISBN-13: 978-0321247445
Product Dimensions: 9.7 x 7.6 x 1.4 inches
More Details about Introduction to Computer Security 1st edition
or
Download Introduction to Computer Security 1st edition PDF Ebook
No comments:
Post a Comment